Android chroot VPN: kungani umhubhe usebenza kodwa izinhlelo zingawunaki
I-chroot ishintsha kuphela ukuseshwa kwemigwaqo, hhayi i-kernel, indawo yamagama yenethiwekhi noma ukubhaliswa kwe-VPN ku-Android. Kuvela imiphumela emibili, futhi yomibili iyamangaza abantu.
Uthola ukusatshalaliswa kwe-Linux okusebenza ngaphansi kwe-chroot ocingweni, ufake iklayenti le-VPN ngaphakathi, bese i-shell imemezela ukuthi umhubhe usuqediwe. Bese ushintshela kusiphequluli futhi ithrafikhi iphuma ngedatha yeselula sengathi akukho okwenzekile. Noma okuphambene: yonke inhlelo ocingweni ilahlekelwa uxhumano ngoba iklayenti lifake umzila ozenzakalelayo endaweni yamagama i-Android ewusebenzisa ngempela. Lezi zimpawu ezimbili zivela engxenyeni eyodwa engekho, futhi akukho nokukodwa okunguphutha kuklayenti le-VPN.
I-shell ithi kuxhunyiwe, izinhlelo azivumelani
Umphumela wokuqala ujwayelekile. Umhubhe wendawo yomsebenzisi ovulwe ku-chroot ungagcwalisa ukuxhawulana kwawo, uphrinta izibalo, futhi uthwale ithrafikhi ekhiqizwa yilowo shell, kuyilapho izinhlelo ze-Android ziqhubeka zisebenzisa inethiwekhi ezenzakalelayo yocingo. Akukho okuzibambayo, ngoba akukho okutshele i-Android ukuthi i-VPN ikhona.
Umphumela wesibili uyingozi. Uma i-chroot yabelana ngendawo yamagama yenethiwekhi ye-Android, okuyinto eyenzayo ngokuzenzakalelayo, inqubo enamandla anele ingengeza imigwaqo kanye ne-TUN interface ethinta ucingo lonke. Bese umhubhe usebenza kuyo yonke inhlelo, kuhlanganise nalezo obungazimiselanga ukuzidlulisa, futhi uxhumano locingo manje luncike kudaemon engenalo ukulawulwa komjikelezo wokuphila, engenaso isibonisi soxhumano futhi engenawo umgomo wokuhlala uvuliwe.
Ukuthi uthole yiphi kulezi ezimbili kungaphendulwa ngomyalo owodwa. Qhathanisa i-ip route ngaphakathi kwe-chroot nomyalo ofanayo ovela ku-shell ye-Android ngaphandle. Umphumela ofanayo usho ukuthi i-chroot isendaweni yamagama yomsingathi: noma yiluphi ushintsho lwenethiwekhi olwenzayo luthinta ucingo lonke. Umphumela ohlukile usho ukuthi isiqalisi sadala indawo yamagama yayo, futhi umhubhe wayo awubonakali ku-Android ngokwakheka kwawo.
I-chroot yashintsha ini futhi ayishintshanga ini
| Object | Effect of a chroot |
|---|---|
| Pathname resolution | Changed: lookups start at the new root |
| Kernel and drivers | Unchanged: the phone's kernel, its TUN driver, its limits |
| Network namespace | Unchanged unless the launcher creates one |
| Android VPN registration | Unchanged: no app consented, no VPN is selected |
Ucingo lwesistimu lwe-chroot lwenza into eyodwa: lushintsha umkhombandlela osetshenziswa ekuxazululeni amagama emigwaqo. Ikhasi le-man lisho ngokucacile ukuthi akulona umngcele wokuphepha, futhi alisho lutho ngezixhumi, imigwaqo noma isimo se-VPN. Konke abantu abakulindele ku-container ye-Linux — isitaki senethiwekhi esiyimfihlo, uhlelo lwamafayela oluhlungiwe, imikhawulo yezinsiza — kuvela kwezinye izindlela okungenzeka isiqalisi sizisebenzisile noma cha.
Yingakho izimangalo zokuthi i-chroot ihlukanisa i-VPN ngokuvamile ziphendula umbuzo ongafanele. Umbuzo ofanele ukuthi inqubo isebenza kuyiphi indawo yamagama futhi iboshwe kuyiphi isizinda se-SELinux, futhi kokubili kuyizici zendlela eyaqalwa ngayo, hhayi zegama elithi chroot.
I-TUN idinga izinto ezintathu, futhi indawo yedivayisi ingenye kuphela
Umhubhe wendabuko wendawo yomsebenzisi udinga idivayisi ye-TUN engayivula, ukusekelwa kwe-kernel yaleyo divayisi, kanye nemvume yokuhlela isixhumi nemigwaqo. Lezi yizimfanelo ezihlukene, futhi ukwakha igama lomgwaqo ngaphansi kwe-/dev akukufezi ngokwako:
ls -l /dev/net/tun
ip tuntap add dev tun0 mode tunKu-Android i-kernel ivamise ukuba nokusekelwa kwe-TUN okufakiwe, ngoba insizakalo ye-VPN yepulatifomu uqobo iyisebenzisa, kodwa lokho akusho ukuthi inqubo yakho ingayisebenzisa. Ukuhlela isixhumi kudinga amandla okuphatha inethiwekhi, futhi i-SELinux inquma ukuthi inqubo ingafinyelela yini indawo yedivayisi. Ukwenqatshwa kubonakala njengephutha lemvume elingenasizathu esicacile, futhi impendulo isekurekhodweni lokucwaninga:
dmesg | grep avc
logcat -d | grep "avc: denied"I-root ayixazululi lokhu. I-SELinux ikhawulela izinqubo ezisebenza njenge-uid 0 ngendlela efanayo nezinye, ngakho i-chroot eqalwe ku-shell ye-root isengase yengatshwe idivayisi eyibonayo. Ukucisha ukuphoqelela ukuze isifaki esidala sisebenze isinqumo socingo lonke esinemiphumela ekude kakhulu kunomhubhe, futhi akulisosombululo se-binary esidala.
Kungani izinhlelo ze-Android zingawunaki umhubhe wakho
Imodeli esekelwa yi-Android wuhlelo lwe-VPN olubhalisa ngensizakalo ye-VPN yepulatifomu, lucela imvume yomsebenzisi kanye, bese luthola isichazi sefayela somhubhe walo. Ipulatifomu bese iqondisa ithrafikhi kuleso sichazi futhi iphoqelela ububanzi bezinhlelo obukhethwe umsebenzisi noma umphathi, yingakho indlela efanayo ingaba ngeyohlelo ngalunye, ngeyephrofayela ngayinye futhi ihlanganiswe nezilungiselelo zokuhlala kuvuliwe nokuvimbela ngaphandle kwe-VPN. Umhlahlandlela wokuthuthukisa i-VPN ku-Android uchaza lokho kuxhawulana, futhi iphuzu elibalulekile ukuthi ukubhaliswa, hhayi iqhinga lokuhambisa imigwaqo.
Idaemon engaphakathi kwe-chroot ayibhalisi neze. Akukho ingxoxo yemvume, akukho isithonjana sokhiye kubha yesimo, akukho uhlu lokufaka noma lokukhipha ngohlelo ngalunye, futhi akukho ukuhlanganyela emgomweni wokuhlala kuvuliwe. Ngakho izinhlelo ziqhubeka zisebenzisa inethiwekhi ezenzakalelayo, futhi umhubhe uthwala kuphela lokho okuthunyelwa yi-shell uqobo.
Ukuya kolunye uhlangothi nakho akusizi. Ukugxisha imigwaqo endaweni yamagama yomsingathi kubamba konke, kuhlanganise ithrafikhi ipulatifomu eyayilindele ukuyigcina yasendaweni, futhi kwenza lokho ngaphandle kokulawula ngohlelo ngalunye nangaphandle kwendlela yokuthi umsebenzisi akubone noma akuhoxise. Akukho silungiselelo saphakathi lapho idaemon ye-chroot ihambisa ithrafikhi yohlelo olulodwa kuphela.
Ukuhambelana kwe-binary kuwudonga oluhlukile
Ngisho noma uhlangothi lwenethiwekhi lubukeka luthakazelisa, ifayela elisebenzayo linezidingo zalo: ukwakheka kwe-CPU, isilayishi esiguqukayo, umtapo wezincwadi we-C, kanye nezinsiza ze-kernel ezilindelwe yilo. I-Android isebenzisa i-bionic esikhundleni se-glibc, futhi i-binary endala eyakhelwe ukusatshalaliswa kwedeskithophu ingase idinge imitapo yezincwadi engekho ocingweni.
Ukuxhumanisa igama lefayela lomtapo wezincwadi ngenkomba kunguqulo entsha akukudali ukuhambelana kwe-ABI, futhi umtapo wezincwadi wokubethela ogciniwe ovela kuphakethe lweminyaka eyishumi awuyona ingxenye enakekelwayo. Uma uhlelo luncike kulokho, uhlelo ukusebenzisa ikhodi enganakekelwa enamandla enethiwekhi ocingweni.
Kufakazela esimweni se-Android bese uhlanza
Hlola lokho okubalulekile kuwe ngempela, ohlangothini olubalulekile: vula uhlelo oluthile, finyelela indawo eyimfihlo ethile, qinisekisa ukuthi isixazululi siphi esiphendulile, bese unqamula umhubhe futhi uqinisekise ukuziphatha okubhaliwe. Umphumela ovela kutheminali engaphakathi kwe-chroot uwubufakazi mayelana nesimo sokusebenza saleyo theminali futhi akukho okunye.
Uma ushintsha imigwaqo yomsingathi ngesikhathi sokuhlola, buyisela emuva futhi ubhale ukuthi washintsha ini. Bese uhlola ukuthi ucingo lunayo yini i-VPN yokuhlala kuvuliwe ehleliwe, ngoba ukuhlola kwakudala okwashiya umthetho kungabonakala njengephutha lepulatifomu ezinyangeni eziyisithupha kamuva.
Ngesidingo sangempela sokufinyelela kude, sebenzisa iklayenti elisekelwayo lensizakalo noma umklamo wegedi ogunyaziwe. Umbuzo ofanele ukubuzwa awuwona wokuthi isifaki esine-root singasetshenziswa yini, kodwa ukuthi ukusetshenziswa okusekelwayo kudlulisa izinhlelo ozidingayo ngaphesheya komngcele owawuhlosile, ngaphandle kokushiya izinguquko zamandla ezingenamnini ocingweni.